Kibana: [ML] - Single Metric Viewer - better sorting/filtering of partition/by field values

[richcollier]

After this issue was reported (https://github.com/elastic/kibana/issues/52618) the list of entities in the dropdowns was expanded to include all entities, not just the anomalous ones.

However, sorting the dropdown by anomalousness (so that the most interesting bubble to the top) would be useful here. Additionally, perhaps a toggle/checkbox to "show all" or "only show anomalous" might be interesting.

[elasticmachine]

Pinging @elastic/ml-ui (:ml)

[joealex]

In earlier versions of ML in the Single metric panel when you select a detector it used to show the overall graph by default without selecting any field. This was very useful to get an anomalous summary for that detector. The dropdown was populated by only anomalous fields and it was very useful since an entry in the dropdown meant there is an anomaly.

Now it is simply populated by all available values which makes this functionality practically very less useful. You have to cycle through each value and see if anyone has an issue and also there is no overall summary view.

• restore overall summary anomaly view when nothing is selected (was removed recently)
• sort the dropdown by anomalousness and have the the most interesting on top
• a toggle/checkbox to "show all" or "only show anomalous" (default to show anomalous)

[peteharverson]

The background behind the decision to change the behavior of the Single Metric Viewer to prompt the user to select a partitioning field before displaying the chart and anomalies is documented in https://github.com/elastic/kibana/issues/18090. The previous behavior had the advantage of showing 'something', but this was outweighed by the fact that in a 'single metric' view we didn't want to show a chart aggregating over multiple metrics, and for larger jobs with many partitioning field values could show many 'red' anomalies.

However I agree it would be useful to provide additional sorting options to the dropdown displaying the list of partitioning field values, allowing the user to sort by anomaly score as well as alphabetically, plus a switch to only list the values with anomalies.